The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses mcp__Ref__ref_read_url or a WebFetch fallback to retrieve content from external URLs provided in research artifacts (resource_url, github_url). While it correctly identifies GitHub as a source, the resource_url can point to any external domain.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites and local files to generate its research summary, creating a surface for indirect prompt injection.
Ingestion points: Local files passed as Type B inputs and external content fetched from research artifact URLs during the codebase exploration phase.
Boundary markers: The instructions lack explicit delimiters or warnings to the agent to disregard instructions found within the fetched content, which could lead to the agent following malicious instructions embedded in the external data.
Capability inventory: The skill has the ability to read local files, fetch network content, and write markdown files to the project's planning directory. It does not possess code execution or shell command capabilities.
Sanitization: No sanitization or filtering is performed on the content retrieved from external sources before it is interpreted by the agent.

feature-discovery